internal/lume: don't capture metrics for paths that don't open

This fixes an issue where an attacker could create infinite cardinality
in my prometheus server by sending a bunch of bogus GET requests.
Metrics are only tracked for paths that make sense.

Signed-off-by: Xe Iaso <me@xeiaso.net>

1 files changed, 6 insertions, 1 deletions

diff --git a/internal/lume/lume.go b/internal/lume/lume.go
index 7a966c0..47fd497 100644
--- a/internal/lume/lume.go
+++ b/internal/lume/lume.go
@@ -87,9 +87,14 @@ func (f *FS) Close() error {
 }
 
 func (f *FS) Open(name string) (fs.File, error) {
+	fin, err := f.fs.Open(name)
+	if err != nil {
+		return nil, err
+	}
+
 	opens.Add(name, 1)
 
-	return f.fs.Open(name)
+	return fin, nil
 }
 
 type Options struct {